2 files changed, 229 insertions, 0 deletions
diff --git a/internal/entropy/entropy.go b/internal/entropy/entropy.go
new file mode 100644
index 0000000..886ecba
--- /dev/null
+++ b/internal/entropy/entropy.go
@@ -0,0 +1,136 @@
+package entropy
+
+import (
+	crand "crypto/rand"
+	"crypto/sha512"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"sync"
+)
+
+const blockSize = sha512.Size
+
+var ErrExternalEntropyRequired = errors.New("external entropy source required")
+
+type HybridOptions struct {
+	RequireExternal bool
+}
+
+type HybridReader struct {
+	base            io.Reader
+	external        io.Reader
+	requireExternal bool
+
+	mu         sync.Mutex
+	counter    uint64
+	degraded   bool
+	degradeErr error
+	buffer     []byte
+}
+
+func NewHybridReader(base io.Reader, external io.Reader, opts HybridOptions) (*HybridReader, error) {
+	if base == nil {
+		base = crand.Reader
+	}
+	if external == nil {
+		return nil, ErrExternalEntropyRequired
+	}
+
+	return &HybridReader{
+		base:            base,
+		external:        external,
+		requireExternal: opts.RequireExternal,
+	}, nil
+}
+
+func (r *HybridReader) Read(p []byte) (int, error) {
+	if len(p) == 0 {
+		return 0, nil
+	}
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	written := 0
+	for written < len(p) {
+		if len(r.buffer) > 0 {
+			n := copy(p[written:], r.buffer)
+			written += n
+			r.buffer = r.buffer[n:]
+			continue
+		}
+
+		block, err := r.nextBlockLocked()
+		if err != nil {
+			return written, err
+		}
+
+		n := copy(p[written:], block[:])
+		written += n
+		if n < len(block) {
+			r.buffer = append(r.buffer[:0], block[n:]...)
+		}
+	}
+
+	return written, nil
+}
+
+func (r *HybridReader) Degraded() bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.degraded
+}
+
+func (r *HybridReader) DegradeError() error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.degradeErr
+}
+
+func (r *HybridReader) nextBlockLocked() ([blockSize]byte, error) {
+	var base [blockSize]byte
+	if _, err := io.ReadFull(r.base, base[:]); err != nil {
+		return [blockSize]byte{}, fmt.Errorf("read OS CSPRNG: %w", err)
+	}
+
+	if r.degraded {
+		return base, nil
+	}
+
+	var external [blockSize]byte
+	if _, err := io.ReadFull(r.external, external[:]); err != nil {
+		if r.requireExternal {
+			return [blockSize]byte{}, fmt.Errorf("read external entropy: %w", err)
+		}
+		r.degraded = true
+		r.degradeErr = err
+		return base, nil
+	}
+
+	var counter [8]byte
+	binary.BigEndian.PutUint64(counter[:], r.counter)
+	r.counter++
+
+	h := sha512.New()
+	h.Write([]byte("qpass hybrid entropy v1\x00"))
+	h.Write(counter[:])
+	h.Write(base[:])
+	h.Write(external[:])
+
+	var out [blockSize]byte
+	copy(out[:], h.Sum(nil))
+	return out, nil
+}
+
+func InstallGlobal(reader io.Reader) func() {
+	if reader == nil {
+		reader = crand.Reader
+	}
+	previous := crand.Reader
+	crand.Reader = reader
+	return func() {
+		crand.Reader = previous
+	}
+}
diff --git a/internal/entropy/entropy_test.go b/internal/entropy/entropy_test.go
new file mode 100644
index 0000000..4ee1a6b
--- /dev/null
+++ b/internal/entropy/entropy_test.go
@@ -0,0 +1,93 @@
+package entropy
+
+import (
+	"bytes"
+	"io"
+	"strings"
+	"testing"
+)
+
+func TestHybridReaderMixesBaseAndExternal(t *testing.T) {
+	base := strings.NewReader(strings.Repeat("a", 4096))
+	external := strings.NewReader(strings.Repeat("b", 4096))
+	reader, err := NewHybridReader(base, external, HybridOptions{})
+	if err != nil {
+		t.Fatalf("NewHybridReader returned error: %v", err)
+	}
+
+	out := make([]byte, 128)
+	if _, err := io.ReadFull(reader, out); err != nil {
+		t.Fatalf("Read returned error: %v", err)
+	}
+
+	if bytes.Equal(out, bytes.Repeat([]byte("a"), len(out))) {
+		t.Fatalf("hybrid output matched raw base reader")
+	}
+	if reader.Degraded() {
+		t.Fatalf("hybrid reader degraded with enough external bytes")
+	}
+}
+
+func TestHybridReaderDegradesToBaseWhenExternalFails(t *testing.T) {
+	base := strings.NewReader(strings.Repeat("x", 4096))
+	external := strings.NewReader("")
+	reader, err := NewHybridReader(base, external, HybridOptions{})
+	if err != nil {
+		t.Fatalf("NewHybridReader returned error: %v", err)
+	}
+
+	out := make([]byte, 32)
+	if _, err := io.ReadFull(reader, out); err != nil {
+		t.Fatalf("Read returned error: %v", err)
+	}
+
+	if !bytes.Equal(out, bytes.Repeat([]byte("x"), len(out))) {
+		t.Fatalf("degraded output should come from base reader")
+	}
+	if !reader.Degraded() {
+		t.Fatalf("hybrid reader should report degraded state")
+	}
+	if reader.DegradeError() == nil {
+		t.Fatalf("hybrid reader should keep the external source error")
+	}
+}
+
+func TestHybridReaderBuffersSmallReads(t *testing.T) {
+	base := strings.NewReader(strings.Repeat("a", blockSize))
+	external := strings.NewReader(strings.Repeat("b", blockSize))
+	reader, err := NewHybridReader(base, external, HybridOptions{})
+	if err != nil {
+		t.Fatalf("NewHybridReader returned error: %v", err)
+	}
+
+	var one [1]byte
+	for i := 0; i < blockSize; i++ {
+		if _, err := io.ReadFull(reader, one[:]); err != nil {
+			t.Fatalf("Read %d returned error: %v", i, err)
+		}
+	}
+
+	if reader.Degraded() {
+		t.Fatalf("small reads should reuse one mixed block before reading external again")
+	}
+}
+
+func TestHybridReaderRequiresExternalWhenConfigured(t *testing.T) {
+	base := strings.NewReader(strings.Repeat("x", 4096))
+	external := strings.NewReader("")
+	reader, err := NewHybridReader(base, external, HybridOptions{RequireExternal: true})
+	if err != nil {
+		t.Fatalf("NewHybridReader returned error: %v", err)
+	}
+
+	out := make([]byte, 1)
+	if _, err := io.ReadFull(reader, out); err == nil {
+		t.Fatalf("Read returned nil error with required external entropy")
+	}
+}
+
+func TestNewHybridReaderRejectsMissingExternalSource(t *testing.T) {
+	if _, err := NewHybridReader(strings.NewReader("base"), nil, HybridOptions{}); err != ErrExternalEntropyRequired {
+		t.Fatalf("NewHybridReader error = %v, want %v", err, ErrExternalEntropyRequired)
+	}
+}